strace is a debugging utility for tracing system calls and signals under Linux.

learn more… | top users | synonyms

2
votes
2answers
24 views

ptrace suid binaries after privilege is dropped

I understand that we probably cannot do ptrace on suid binaries. However, I'm wondering why we cannot do ptrace after the binary drops its previlege to uid instead of euid. For example, in the binary ...
1
vote
2answers
74 views

Exclude PIDs when comparing strace output

I want to debug like: strace -fe open python /usr/bin/gnome-tweak-tool 2>>/tmp/hello.log strace -fe open python /usr/bin/gnome-tweak-tool 2>>/tmp/hello2.log Then use kdiff3 to compare ...
1
vote
3answers
138 views

How can I find which user is accessing a file using strace?

My actual problem is that Nginx is not able to render pages (403 forbidden) despite the permissions being set to appropriately (in my opinion) The directory of stackoverflow at default location: ...
0
votes
0answers
70 views

What differences are between running a command in shell with and without `bash -c`?

What is the difference of running a command directly in a bash shell, and run it as bash -c <command> in a bash shell? The purpose of my question is that I would like to know how a command is ...
0
votes
0answers
56 views

Compare running a command directly and in background

In Ubuntu, I run date in an interactive bash shell whose pid is 6913, and at the same time, trace the bash shell from another interactive bash shell by strace. By using tracing, I would like to ...
1
vote
1answer
87 views

How to understand the output of tracing running an external command in bash?

In Ubuntu, I run date directly in an interactive bash shell whose pid is 6913. $ date Wed Mar 2 23:57:44 EST 2016 At the same time, I trace the bash shell 6913 from another interactive bash shell ...
1
vote
0answers
59 views

How to understand the output of tracing running an external command in background via strace

In Ubuntu, I run date & in an interactive bash shell whose pid is 6913, and at the same time, trace the bash shell from another interactive bash shell by strace. The output of tracing the first ...
0
votes
2answers
63 views

Why doesn't strace report that the parent shell fork() a child process before execve() a command?

strace runs a specified command until it exits. It intercepts and records the system calls which are called by a process and the signals which are received by a process. When running an external ...
2
votes
2answers
51 views

How can strace monitor itself?

I have a Hypothetical Situation. (1) Let us say we have two strace Processes S1 & S2, which are simply monitoring each other. How can this be possible ? Well, in the command-line options for ...
1
vote
1answer
45 views

Most elegant way to terminate straced program

I want to capture a certain thing with strace and then immediately exit. This way the program stays alive: strace ... program 2>&1 | grep --line-buffered ... | read line. Is there a simple way ...
1
vote
1answer
62 views

exit status of command is different when it is run via strace

I can normaly mount/umount FTP as file system using following commands: └──> curlftpfs -o codepage=windows-1250 anonymous:anonymous@192.168.3.13 /home/marek/ftpfs └──> ls /home/marek/ftpfs/ 1 2 ...
2
votes
2answers
143 views

Debugging a kernel shut down?

I'm on Linux 4.2.0, the Ubuntu Wily HWE kernel for Ubuntu 14.04 (which is what I'm running). There's a nasty bug on MacBook 11,4 and 11,5 models where the laptops won't actually ever shut off, they ...
4
votes
0answers
114 views

Linux strace not following child processes even with -f (multithreaded parent)

Note: there are several similar questions, with the general answer being "If you want to trace a multithreaded process, or follow children, use -f". This doesn't help me, as i am using -f already. I ...
1
vote
0answers
27 views

How to debug a bash script in a qemu-arm chroot

I'm running a debian debootstrap script which creates an arm system. However, the script fails at some point and the error message does not really help. So I'll have to do some more debugging which is ...
1
vote
0answers
15 views

How can I see file events of all processes matching those with keyword in path?

How can I see file events of all processes matching only those with keyword in path ? Here is my typical usecase. I'm investigating why Docker can't authorize with 3rd-party service using credentials ...
0
votes
1answer
35 views

strace vs web browser

I was trying to strace an iceweasel like this: strace -e trace=connect iceweasel And I was expecting to see calls to connect when I load new pages. Surprisingly, there weren't any. Why so? Am I ...
1
vote
0answers
60 views

SIGSEGV: 0x0000000000000000 in ?? ()

I am executing an iperf connection between two UML machines running the following kernel: Linux client 4.1.0-ga61e56d #55 Mon Nov 30 13:51:59 CET 2015 x86_64 GNU/Linux I am working on the TCP/IP ...
0
votes
0answers
48 views

spstack, ptrace stopped a process

My server is busy with sys CPU, so I used pstrace to trace it but no output, so I cancel the command inside putty, and then use pstack to trace it again, but no result return either and I closed the ...
1
vote
0answers
71 views

Tracing syscalls of chromium or setting chromium configuration

Given complex application like for example chromium, does anyone now convenient (and actually working) method of tracing it's syscalls? What i am doing Starting chromium in temporary profile but ...
3
votes
1answer
46 views

How does ssh always manage to reset the terminal attributes?

If I run strace -e trace=ioctl -v ssh some_remote_host I see a line like this: ioctl(0, SNDCTL_TMR_STOP or TCSETSW, {c_iflags=0x6006, c_oflags=0x4, c_cflags=0x 4bf, c_lflags=0xa00, c_line=0, ...
0
votes
1answer
61 views

Citrix Receiver - 13.2.1 - hangs forever

I had Citrix Receiver working on funtoo linux a while back, but made some changes and could not figure for the life of me what it was. I thought perhaps Funtoo was not stable or there was a conflict ...
3
votes
1answer
191 views

Deleting an empty file, why there are so many sys calls ?

Try to create an empty file and strace the operations that are involved to delete it. The list is very long: touch a strace rm a execve("/bin/rm", ["rm", "a"], [/* 20 vars */]) = 0 brk(0) ...
-1
votes
2answers
64 views

Getting filename based on filehandle number

I am running strace -p 1234 -o strace.out on a system where process it is suspected that process 1234 is performing badly. I see these reads that take almost a minute to complete: read(11, ...
2
votes
1answer
291 views

Why am I unable to attach `strace` to a kworker process?

As root, I try to attach strace to a running kworker process, without success. root@rasal# whoami root root@rasal:/# cat /proc/sys/kernel/yama/ptrace_scope 0 ...
14
votes
4answers
2k views

What system call is used to load libraries in Linux?

In strace outputs, the paths to the libraries that executables call are in calls to open(). Is this the system call used by executables that are dynamically linked? What about dlopen()? open() isn't a ...
0
votes
0answers
28 views

strace | Who's making syscalls ? | Where are the instructions?

I've been told that strace is used to track all the system calls made while running an application. I see that there are a lot of system calls made even before the first printf ( now write ) call. ...
2
votes
1answer
254 views

Strace - Filedescriptor 3

I am not sure what the filedescriptor number 3 means here? Is this descriptor some kind of pointer to the connection made to the harddrive to get the file datlog.txt? I guess so because the subroutine ...
3
votes
1answer
216 views

BASH: Fifo troubles - seems selective about input

So I am having a problem with a BASH service in Debian 7 that I've been working on for quite a while and that randomly started having trouble with its fifo, or so it seems. It is based on kind of your ...
1
vote
1answer
74 views

Why doesn't /bin/login appear in ps output when someone is logging in

I wanted to monitor what happens when a test user logs in to my CentOS 6.4 system, so I tried this to poll ps for /bin/login and strace the pid when it appears: until [[ $(ps -ef|grep -q [l]ogin)$? ...
1
vote
1answer
78 views

how do applications communicate via sockets

On my computer audio works sometimes and sometimes not. I want to troubleshoot this. First I verified I am using pulseaudio. I did this by strace'ing the pulseaudio process: [pid 2289] send(28, ...
2
votes
1answer
109 views

Monitor and alert user when stty settings change?

A particularly large (~10^6 LOC) program causes my stty settings to change from echo ixon icanon to -echo -ixon -icanon and I would like to find the function in this massive program that causes this ...
2
votes
1answer
128 views

Sending a string to strace for “printf debugging”

While there are command line versions of strace for windows, the defacto GUI equivalent of strace on windows is Sysinternals procmon. In addition to letting you view file, registry, network and other ...
3
votes
1answer
401 views

Decode / summarise strace logs

OK, so it's no secret that strace produces vast amounts of output. (I'm aware there are various options to filter the output a bit.) Are there any tools to process a raw strace log into something ...
2
votes
1answer
469 views

Tracing the node process executing my script from “npm start”

I am attempting to debug a cli node project. Its easier to do npm start than npm install -g . && libgrabber. However, I'd like to run strace on the process. The output of strace -f on the npm ...
2
votes
1answer
366 views

Strace Hello World program

So I am trying to understand systemcalls with the following "Hello World!" program: #include <stdio.h> int main(){ printf("Hello World!\n"); return 0; } and then I run strace on the ...
8
votes
6answers
838 views

why strace ignores my alias for rm?

I have an alias set for my rm command. If I run alias command, this is what I get as output. alias rm='rm -i' Now, when I run the rm command it works fine as expected. rm ramesh rm: remove ...
0
votes
2answers
337 views

How does rsync encode filenames?

By using strace on the active rsync process, I can see output like: read(4, "9\0\0\7\1\10\0\1\10\0\1\10\0\1\10\0\1\10\0\1\10\0\1\10\0\1\10\0\1\10\0\1"..., 16384) = 61 write(3, ...
3
votes
1answer
251 views

strace works for some builtin commands

I'm trying to understand some kernel level concepts in Linux. I was checking on the difference between shell builtin commands and the other executable commands. This wonderful answer clearly tells ...
17
votes
1answer
463 views

Tracing executable without read permissions

I found some surprising behavior on Ubuntu 14.04 when using strace on an executable, which I do not have read permission on. I wonder if this is a bug, or if some standard mandates this obscure ...
2
votes
3answers
662 views

Can strace/ptrace cause a program to crash?

So recently, I was discussing strace with somebody, and they were asking what would happen if you straced a running process just as it was creating a network socket or something similar. Could this ...
7
votes
2answers
634 views

How to determine what instructions a process is executing?

I know about strace and ltrace, but that only tells me what system calls and library calls a process is executing, respectively. I would like to know exactly what instructions a process is executing. ...
1
vote
1answer
563 views

How to use pv with dd?

I'm trying to use dd with pv to write an iso to a usb drive. I did: iso="myiso.iso"; dd if="$iso" bs=1M | pv --eta --size $(ls -l "$iso" | awk '{print $5}') --progress --bytes --rate --wait > ...
3
votes
2answers
1k views

running strace for specific period of time

How to run strace on a user process for specific period of time, say 1 minute, without terminating the user process and without using Ctrl+C? I want to create a script to automating strace execution ...
2
votes
1answer
206 views

Apache suexec won't work with strace

I have an Apache instance with mod_suexec enabled. I'm trying to debug a problem and am starting Apache with strace to try and see what's happening. However, when I start Apache like this: # strace ...
2
votes
1answer
298 views

Make sense of this strace output

Can anyone make sense of this strace output? [pid 25302] read(34, "}B\311\204\n\250\347$\220\266kRb\304a^^\2504\303k\235\227T\223\16\231\306\277\254\256\306", 32) = 32 It's from a Linux system ...
0
votes
0answers
647 views

How do I make strace “decode” AF_NETLINK communication as with ioctl?

strace usually "deciphers" ioctl calls, showing what they mean, even resolving network interface names and so on. But the same operation performed using AF_NETLINK stays opaque in strace. How can I ...
1
vote
0answers
358 views

How to debug a semop failure?

Using a 2.6.30-gentoo-r4 Linux a very complex system of php code is executed (with 4.4.9-pl0-gentoo and 5.2.10-pl0-gentoo), which occasionally runs into a semaphore blocking problem. The call to the ...
2
votes
1answer
3k views

How is it that I can attach strace to a process that isn't in the output of ps?

I'm trying to debug why our integration tests are taking so long and it looks like they're hanging part way through. I logged onto our test service and saw the following behaviour: root@colossus:~# ...
0
votes
1answer
158 views

MC and MCedit take long time to start

I recently discovered that my MidnightCommander takes around 40 seconds for every startup and the same goes for McEdit. I access my machine only via ssh and of course I'm not logging in as root, only ...
1
vote
1answer
1k views

Too Much System Time

I have observed that when running CESM (a weather modeling application), the top command shows a great deal of time is spent on system calls, about 25% to 60%, and only 40% to 75% is used in user ...